CVEvulnerability
CVE-2020-27449
6.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2023-08-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
Description
Cross Site Scripting (XSS) vulnerability in Query Report feature in Zoho ManageEngine Password Manager Pro version 11001, allows remote attackers to execute arbitrary code and steal cookies via crafted JavaScript payload.
Affected configurations
• zohocorp manageengine password manager pro 11.1
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://bugbounty.zoho.com/bb/#/bug/101000003619211 Permissions Required, Vendor Advisory
- https://www.manageengine.com/products/passwordmanagerpro/release-notes.html#pmp11002 Product, Release Notes
- https://bugbounty.zoho.com/bb/#/bug/101000003619211 Permissions Required, Vendor Advisory
- https://www.manageengine.com/products/passwordmanagerpro/release-notes.html#pmp11002 Product, Release Notes